1 files changed, 243 insertions, 72 deletions

diff --git a/ssh.c b/ssh.c
index e655e68da..1419f9874 100644
--- a/ssh.c
+++ b/ssh.c
@@ -40,7 +40,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh.c,v 1.209 2004/03/11 10:21:17 markus Exp $");
+RCSID("$OpenBSD: ssh.c,v 1.224 2004/07/28 09:40:29 markus Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/err.h>
@@ -53,31 +53,31 @@ RCSID("$OpenBSD: ssh.c,v 1.209 2004/03/11 10:21:17 markus Exp $");
 #include "xmalloc.h"
 #include "packet.h"
 #include "buffer.h"
+#include "bufaux.h"
 #include "channels.h"
 #include "key.h"
 #include "authfd.h"
 #include "authfile.h"
 #include "pathnames.h"
+#include "dispatch.h"
 #include "clientloop.h"
 #include "log.h"
 #include "readconf.h"
 #include "sshconnect.h"
-#include "tildexpand.h"
-#include "dispatch.h"
 #include "misc.h"
 #include "kex.h"
 #include "mac.h"
-#include "sshtty.h"
+#include "sshpty.h"
+#include "match.h"
+#include "msg.h"
+#include "monitor_fdpass.h"
+#include "uidswap.h"
 
 #ifdef SMARTCARD
 #include "scard.h"
 #endif
 
-#ifdef HAVE___PROGNAME
 extern char *__progname;
-#else
-char *__progname;
-#endif
 
 /* Flag indicating whether debug mode is on.  This can be set on the command line. */
 int debug_flag = 0;
@@ -141,16 +141,23 @@ static int client_global_request_id = 0;
 /* pid of proxycommand child process */
 pid_t proxy_command_pid = 0;
 
+/* fd to control socket */
+int control_fd = -1;
+
+/* Only used in control client mode */
+volatile sig_atomic_t control_client_terminate = 0;
+u_int control_server_pid = 0;
+
 /* Prints a help message to the user.  This function never returns. */
 
 static void
 usage(void)
 {
         fprintf(stderr,
-"usage: ssh [-1246AaCfghkNnqsTtVvXxY] [-b bind_address] [-c cipher_spec]\n"
+"usage: ssh [-1246AaCfghkMNnqsTtVvXxY] [-b bind_address] [-c cipher_spec]\n"
 "           [-D port] [-e escape_char] [-F configfile] [-i identity_file]\n"
 "           [-L port:host:hostport] [-l login_name] [-m mac_spec] [-o option]\n"
-"           [-p port] [-R port:host:hostport] [user@]hostname [command]\n"
+"           [-p port] [-R port:host:hostport] [-S ctl] [user@]hostname [command]\n"
         );
         exit(1);
 }
@@ -158,6 +165,7 @@ usage(void)
 static int ssh_session(void);
 static int ssh_session2(void);
 static void load_public_identity_files(void);
+static void control_client(const char *path);
 
 /*
  * Main program for the ssh client.
@@ -228,7 +236,7 @@ main(int ac, char **av)
 
 again:
         while ((opt = getopt(ac, av,
-            "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:L:NPR:TVXY")) != -1) {
+            "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:L:MNPR:S:TVXY")) != -1) {
                 switch (opt) {
                 case '1':
                         options.protocol = SSH_PROTO_1;
@@ -337,7 +345,7 @@ again:
                         if (ciphers_valid(optarg)) {
                                 /* SSH2 only */
                                 options.ciphers = xstrdup(optarg);
-                                options.cipher = SSH_CIPHER_ILLEGAL;
+                                options.cipher = SSH_CIPHER_INVALID;
                         } else {
                                 /* SSH1 only */
                                 options.cipher = cipher_number(optarg);
@@ -364,6 +372,10 @@ again:
                                 exit(1);
                         }
                         break;
+                case 'M':
+                        options.control_master =
+                            (options.control_master >= 1) ? 2 : 1;
+                        break;
                 case 'p':
                         options.port = a2port(optarg);
                         if (options.port == 0) {
@@ -432,6 +444,11 @@ again:
                 case 's':
                         subsystem_flag = 1;
                         break;
+                case 'S':
+                        if (options.control_path != NULL)
+                                free(options.control_path);
+                        options.control_path = xstrdup(optarg);
+                        break;
                 case 'b':
                         options.bind_address = optarg;
                         break;
@@ -526,16 +543,17 @@ again:
          * file if the user specifies a config file on the command line.
          */
         if (config != NULL) {
-                if (!read_config_file(config, host, &options))
+                if (!read_config_file(config, host, &options, 0))
                         fatal("Can't open user config file %.100s: "
                             "%.100s", config, strerror(errno));
         } else  {
                 snprintf(buf, sizeof buf, "%.100s/%.100s", pw->pw_dir,
                     _PATH_SSH_USER_CONFFILE);
-                (void)read_config_file(buf, host, &options);
+                (void)read_config_file(buf, host, &options, 1);
 
                 /* Read systemwide configuration file after use config. */
-                (void)read_config_file(_PATH_HOST_CONFIG_FILE, host, &options);
+                (void)read_config_file(_PATH_HOST_CONFIG_FILE, host,
+                    &options, 0);
         }
 
         /* Fill configuration defaults. */
@@ -565,6 +583,13 @@ again:
             strcmp(options.proxy_command, "none") == 0)
                 options.proxy_command = NULL;
 
+        if (options.control_path != NULL) {
+                options.control_path = tilde_expand_filename(
+                   options.control_path, original_real_uid);
+        }
+        if (options.control_path != NULL && options.control_master == 0)
+                control_client(options.control_path); /* This doesn't return */
+
         /* Open a connection to the remote host. */
         if (ssh_connect(host, &hostaddr, options.port,
             options.address_family, options.connection_attempts,
@@ -620,8 +645,10 @@ again:
          * user's home directory if it happens to be on a NFS volume where
          * root is mapped to nobody.
          */
-        seteuid(original_real_uid);
-        setuid(original_real_uid);
+        if (original_effective_uid == 0) {
+                PRIV_START;
+                permanently_set_uid(pw);
+        }
 
         /*
          * Now that we are back to our own permissions, create ~/.ssh
@@ -677,6 +704,9 @@ again:
         exit_status = compat20 ? ssh_session2() : ssh_session();
         packet_close();
 
+        if (options.control_path != NULL && control_fd != -1)
+                unlink(options.control_path);
+
         /*
          * Send SIGHUP to proxy command if used. We don't wait() in
          * case it hangs and instead rely on init to reap the child
@@ -776,17 +806,17 @@ x11_get_proto(char **_proto, char **_data)
          * for the local connection.
          */
         if (!got_data) {
-                u_int32_t rand = 0;
+                u_int32_t rnd = 0;
 
                 logit("Warning: No xauth data; "
                     "using fake authentication data for X11 forwarding.");
                 strlcpy(proto, SSH_X11_PROTO, sizeof proto);
                 for (i = 0; i < 16; i++) {
                         if (i % 4 == 0)
-                                rand = arc4random();
+                                rnd = arc4random();
                         snprintf(data + 2 * i, sizeof data - 2 * i, "%02x",
-                            rand & 0xff);
-                        rand >>= 8;
+                            rnd & 0xff);
+                        rnd >>= 8;
                 }
         }
 }
@@ -973,7 +1003,7 @@ ssh_session(void)
 }
 
 static void
-client_subsystem_reply(int type, u_int32_t seq, void *ctxt)
+ssh_subsystem_reply(int type, u_int32_t seq, void *ctxt)
 {
         int id, len;
 
@@ -1005,40 +1035,53 @@ client_global_request_reply_fwd(int type, u_int32_t seq, void *ctxt)
                     options.remote_forwards[i].port);
 }
 
-/* request pty/x11/agent/tcpfwd/shell for channel */
 static void
-ssh_session2_setup(int id, void *arg)
+ssh_control_listener(void)
 {
-        int len;
-        int interactive = 0;
-        struct termios tio;
+        struct sockaddr_un addr;
+        mode_t old_umask;
+        int addr_len;
 
-        debug2("ssh_session2_setup: id %d", id);
+        if (options.control_path == NULL || options.control_master <= 0)
+                return;
 
-        if (tty_flag) {
-                struct winsize ws;
-                char *cp;
-                cp = getenv("TERM");
-                if (!cp)
-                        cp = "";
-                /* Store window size in the packet. */
-                if (ioctl(fileno(stdin), TIOCGWINSZ, &ws) < 0)
-                        memset(&ws, 0, sizeof(ws));
+        memset(&addr, '\0', sizeof(addr));
+        addr.sun_family = AF_UNIX;
+        addr_len = offsetof(struct sockaddr_un, sun_path) +
+            strlen(options.control_path) + 1;
 
-                channel_request_start(id, "pty-req", 0);
-                packet_put_cstring(cp);
-                packet_put_int(ws.ws_col);
-                packet_put_int(ws.ws_row);
-                packet_put_int(ws.ws_xpixel);
-                packet_put_int(ws.ws_ypixel);
-                tio = get_saved_tio();
-                tty_make_modes(/*ignored*/ 0, &tio);
-                packet_send();
-                interactive = 1;
-                /* XXX wait for reply */
+        if (strlcpy(addr.sun_path, options.control_path,
+            sizeof(addr.sun_path)) >= sizeof(addr.sun_path))
+                fatal("ControlPath too long");
+
+        if ((control_fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
+                fatal("%s socket(): %s\n", __func__, strerror(errno));
+
+        old_umask = umask(0177);
+        if (bind(control_fd, (struct sockaddr*)&addr, addr_len) == -1) {
+                control_fd = -1;
+                if (errno == EINVAL)
+                        fatal("ControlSocket %s already exists",
+                            options.control_path);
+                else
+                        fatal("%s bind(): %s\n", __func__, strerror(errno));
         }
-        if (options.forward_x11 &&
-            getenv("DISPLAY") != NULL) {
+        umask(old_umask);
+
+        if (listen(control_fd, 64) == -1)
+                fatal("%s listen(): %s\n", __func__, strerror(errno));
+
+        set_nonblock(control_fd);
+}
+
+/* request pty/x11/agent/tcpfwd/shell for channel */
+static void
+ssh_session2_setup(int id, void *arg)
+{
+        extern char **environ;
+
+        int interactive = tty_flag;
+        if (options.forward_x11 && getenv("DISPLAY") != NULL) {
                 char *proto, *data;
                 /* Get reasonable local authentication information. */
                 x11_get_proto(&proto, &data);
@@ -1056,27 +1099,8 @@ ssh_session2_setup(int id, void *arg)
                 packet_send();
         }
 
-        len = buffer_len(&command);
-        if (len > 0) {
-                if (len > 900)
-                        len = 900;
-                if (subsystem_flag) {
-                        debug("Sending subsystem: %.*s", len, (u_char *)buffer_ptr(&command));
-                        channel_request_start(id, "subsystem", /*want reply*/ 1);
-                        /* register callback for reply */
-                        /* XXX we assume that client_loop has already been called */
-                        dispatch_set(SSH2_MSG_CHANNEL_FAILURE, &client_subsystem_reply);
-                        dispatch_set(SSH2_MSG_CHANNEL_SUCCESS, &client_subsystem_reply);
-                } else {
-                        debug("Sending command: %.*s", len, (u_char *)buffer_ptr(&command));
-                        channel_request_start(id, "exec", 0);
-                }
-                packet_put_string(buffer_ptr(&command), buffer_len(&command));
-                packet_send();
-        } else {
-                channel_request_start(id, "shell", 0);
-                packet_send();
-        }
+        client_session2_setup(id, tty_flag, subsystem_flag, getenv("TERM"),
+            NULL, fileno(stdin), &command, environ, &ssh_subsystem_reply);
 
         packet_set_interactive(interactive);
 }
@@ -1122,7 +1146,7 @@ ssh_session2_open(void)
 
         channel_send_open(c->self);
         if (!no_shell_flag)
-                channel_register_confirm(c->self, ssh_session2_setup);
+                channel_register_confirm(c->self, ssh_session2_setup, NULL);
 
         return c->self;
 }
@@ -1134,6 +1158,7 @@ ssh_session2(void)
 
         /* XXX should be pre-session */
         ssh_init_forwarding();
+        ssh_control_listener();
 
         if (!no_shell_flag || (datafellows & SSH_BUG_DUMMYCHAN))
                 id = ssh_session2_open();
@@ -1187,3 +1212,149 @@ load_public_identity_files(void)
                 options.identity_keys[i] = public;
         }
 }
+
+static void
+control_client_sighandler(int signo)
+{
+        control_client_terminate = signo;
+}
+
+static void
+control_client_sigrelay(int signo)
+{
+        if (control_server_pid > 1)
+                kill(control_server_pid, signo);
+}
+
+static int
+env_permitted(char *env)
+{
+        int i;
+        char name[1024], *cp;
+
+        strlcpy(name, env, sizeof(name));
+        if ((cp = strchr(name, '=')) == NULL)
+                return (0);
+
+        *cp = '\0';
+
+        for (i = 0; i < options.num_send_env; i++)
+                if (match_pattern(name, options.send_env[i]))
+                        return (1);
+
+        return (0);
+}
+
+static void
+control_client(const char *path)
+{
+        struct sockaddr_un addr;
+        int i, r, sock, exitval, num_env, addr_len;
+        Buffer m;
+        char *cp;
+        extern char **environ;
+
+        memset(&addr, '\0', sizeof(addr));
+        addr.sun_family = AF_UNIX;
+        addr_len = offsetof(struct sockaddr_un, sun_path) +
+            strlen(path) + 1;
+
+        if (strlcpy(addr.sun_path, path,
+            sizeof(addr.sun_path)) >= sizeof(addr.sun_path))
+                fatal("ControlPath too long");
+
+        if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
+                fatal("%s socket(): %s", __func__, strerror(errno));
+
+        if (connect(sock, (struct sockaddr*)&addr, addr_len) == -1)
+                fatal("Couldn't connect to %s: %s", path, strerror(errno));
+
+        if ((cp = getenv("TERM")) == NULL)
+                cp = "";
+
+        buffer_init(&m);
+
+        /* Get PID of controlee */
+        if (ssh_msg_recv(sock, &m) == -1)
+                fatal("%s: msg_recv", __func__);
+        if (buffer_get_char(&m) != 0)
+                fatal("%s: wrong version", __func__);
+        /* Connection allowed? */
+        if (buffer_get_int(&m) != 1)
+                fatal("Connection to master denied");
+        control_server_pid = buffer_get_int(&m);
+
+        buffer_clear(&m);
+        buffer_put_int(&m, tty_flag);
+        buffer_put_int(&m, subsystem_flag);
+        buffer_put_cstring(&m, cp);
+
+        buffer_append(&command, "\0", 1);
+        buffer_put_cstring(&m, buffer_ptr(&command));
+
+        if (options.num_send_env == 0 || environ == NULL) {
+                buffer_put_int(&m, 0);
+        } else {
+                /* Pass environment */
+                num_env = 0;
+                for (i = 0; environ[i] != NULL; i++)
+                        if (env_permitted(environ[i]))
+                                num_env++; /* Count */
+
+                buffer_put_int(&m, num_env);
+
+                for (i = 0; environ[i] != NULL && num_env >= 0; i++)
+                        if (env_permitted(environ[i])) {
+                                num_env--;
+                                buffer_put_cstring(&m, environ[i]);
+                        }
+        }
+
+        if (ssh_msg_send(sock, /* version */0, &m) == -1)
+                fatal("%s: msg_send", __func__);
+
+        mm_send_fd(sock, STDIN_FILENO);
+        mm_send_fd(sock, STDOUT_FILENO);
+        mm_send_fd(sock, STDERR_FILENO);
+
+        /* Wait for reply, so master has a chance to gather ttymodes */
+        buffer_clear(&m);
+        if (ssh_msg_recv(sock, &m) == -1)
+                fatal("%s: msg_recv", __func__);
+        if (buffer_get_char(&m) != 0)
+                fatal("%s: master returned error", __func__);
+        buffer_free(&m);
+
+        signal(SIGINT, control_client_sighandler);
+        signal(SIGTERM, control_client_sighandler);
+        signal(SIGWINCH, control_client_sigrelay);
+
+        if (tty_flag)
+                enter_raw_mode();
+
+        /* Stick around until the controlee closes the client_fd */
+        exitval = 0;
+        for (;!control_client_terminate;) {
+                r = read(sock, &exitval, sizeof(exitval));
+                if (r == 0) {
+                        debug2("Received EOF from master");
+                        break;
+                }
+                if (r > 0)
+                        debug2("Received exit status from master %d", exitval);
+                if (r == -1 && errno != EINTR)
+                        fatal("%s: read %s", __func__, strerror(errno));
+        }
+
+        if (control_client_terminate)
+                debug2("Exiting on signal %d", control_client_terminate);
+
+        close(sock);
+
+        leave_raw_mode();
+
+        if (tty_flag && options.log_level != SYSLOG_LEVEL_QUIET)
+                fprintf(stderr, "Connection to master closed.\r\n");
+
+        exit(exitval);
+}